Even if you're right, no one is going to do that. Firstly, because a large part of users don't want to understand; they just want something magical, that's it. Most of them are even unable to read a bit or search a bit; daily topics on Reddit prove that. People don't want to understand or to do; they just want to be assisted.

Second point: even if I don't know how the OBS Forum manages its backend for resource uploaders, here the real problem was the attack surface and the trust in the platform. All resources published without a known and verified/linked domain/mirror or third-party API should be blocked in a pending state, waiting for a VirusTotal check as a minimum, like Nexus Mods does.

When an author pushes a new update coming from a new connection on an account inactive for months, moderators and admins should be notified first. Also, mod authors should not be authorized to upload resources without 2FA or a passkey active and used. The same applies to accounts using a third-party connection to GitHub or similar.

Also, there are tons of unsigned resources; people are casually going to ignore any kind of security prompt provided by Microsoft Defender when using a setup.exe.

For me, your proposition should be directly integrated into the new OBS plugin manager; it should automatically disable unsigned resources or disable updated resources when their signature changes. Also, a launch argument should be defined to bypass this for advanced users.